How to Control PackageKit and Set Up Automatic Updates on Linux

Updated: 29 September 2026 · Applies to: PackageKit 1.2 and dnf-automatic 4 on AlmaLinux and Rocky Linux 9 and 10, RHEL 9 and 10; unattended-upgrades on Ubuntu 24.04 and 26.04 and Debian 13

PackageKit is the background service behind graphical software tools such as GNOME Software. On desktops it checks for updates, downloads them and offers to install them. On servers it is usually not wanted: it can hold the package database while you run dnf, and servers are better updated by a tool meant for them. This guide shows how to control PackageKit and how to set up automatic updates the server way.

On a desktop: control automatic downloads

In GNOME Software, open Preferences and switch Automatic Updates on or off. From the command line, for the current user:

gsettings set org.gnome.software download-updates false    # stop automatic downloads
gsettings set org.gnome.software download-updates true     # turn them back on

GNOME Software installs downloaded updates at the next reboot ("offline updates"), so nothing changes under running programs.

On a server: turn PackageKit off

PackageKit starts on demand through D-Bus, so stopping it is not enough. Mask it:

systemctl mask --now packagekit

Undo with systemctl unmask packagekit. On servers without a desktop you can also remove it (dnf remove PackageKit or apt remove packagekit) if no other installed package needs it; read the list of packages to be removed first.

Automatic updates on AlmaLinux, Rocky Linux and RHEL: dnf-automatic

dnf install dnf-automatic

Choose one of the timers the package provides:

• dnf-automatic-notifyonly.timer: only report available updates.
• dnf-automatic-download.timer: download updates, but do not install them.
• dnf-automatic-install.timer: download and install updates.
• dnf-automatic.timer: do what /etc/dnf/automatic.conf says (by default: download, do not apply).

systemctl enable --now dnf-automatic-install.timer
systemctl list-timers 'dnf-automatic*'

To install only security updates, set upgrade_type = security in /etc/dnf/automatic.conf. Reports can be sent by email; set that up in the [emitters] and [email] sections.

Automatic updates on Ubuntu and Debian: unattended-upgrades

apt install unattended-upgrades
dpkg-reconfigure -plow unattended-upgrades

By default it installs security updates. Choices such as automatic reboots and email reports are in /etc/apt/apt.conf.d/50unattended-upgrades. Test with unattended-upgrade --dry-run --debug.

Good practice

• Automatic installation is safest for security updates. For large changes, update by hand at a planned time.
• Some updates (kernel, glibc, systemd) need a reboot. Check with dnf needs-restarting -r, or look for /var/run/reboot-required on Ubuntu and Debian.
• On cPanel servers, cPanel manages its own updates; keep using WHM's Update Preferences for cPanel itself.

Official documentation: dnf-automatic and Debian wiki: unattended upgrades.